Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and The
Total Page:16
File Type:pdf, Size:1020Kb
EDPL 3|2017 Tracking Walls, Take-It-Or-Leave-It Choices 1 Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation Frederik J Zuiderveen Borgesius, Sanne Kruikemeier, Sophie C Boerman and Natali Helberger* On the internet, we encounter take-it-or-leave-it choices regarding our privacy on a daily ba- sis. In Europe, online tracking for targeted advertising generally requires the internet users’ consent to be lawful. Some websites use a tracking wall, a barrier that visitors can only pass if they consent to tracking by third parties. When confronted with such a tracking wall, many people click ‘I agree’ to tracking. A survey that we conducted shows that most people find tracking walls unfair and unacceptable. We analyse under which conditions the ePrivacy Di- rective and the General Data Protection Regulation allow tracking walls. We provide a list of circumstances to assess when a tracking wall makes consent invalid. We also explore how the EU lawmaker could regulate tracking walls, for instance in the ePrivacy Regulation. It should be seriously considered to ban tracking walls, at least in certain circumstances. I. Introduction First, we give a brief introduction to online track- ing and tracking walls. Next, we report on a large- On the internet, we encounter many take-it-or-leave-it scale survey we conducted in the Netherlands: most choicesregardingourprivacy.Socialnetworksitesand people consider tracking walls unfair, and do not find email services typically require users to agree to a pri- it acceptable when they have to disclose their person- vacy statement or to terms and conditions – if people al data in exchange for using a website. do not agree, they cannot use the service. Some web- Then we analyse whether such tracking walls are sites use a tracking wall, a barrier that visitors can on- allowed under European data privacy law, more ly pass if they agree to tracking by third parties. When specifically the ePrivacy Directive, and the General confronted with such take-it-or-leave-it choices, many Data Protection Regulation (GDPR).1 The European people might click ‘I agree’ to any request. It is debat- Commission has published a proposal for an ePriva- able whether people have meaningful control over cy Regulation, which should replace the ePrivacy Di- personal information if they have to consent to track- rective.2 That ePrivacy proposal does not contain spe- ing to be able to use services or websites. This article cific rules regarding tracking walls. We explore how explores the problem of tracking walls, and discusses the EU lawmaker could deal with tracking walls, and several options for the EU lawmaker to regulate them. discuss four options: (i) no specific rules for tracking * Dr Frederik J Zuiderveen Borgesius is a researcher at the Institute cil, ERC, under Grant 638514 (PersoNews - PI N Helberger). The for Information Law (IViR) of the University of Amsterdam. Dr authors would like to thank Joyce Neys, Candida Leone, Sarah Sanne Kruikemeier is assistant professor Political Communication Eskens, the participants in the discussion at the TPRC 44th and Journalism at the Amsterdam School of Communication Research Conference on Communications, Information and Research (ASCoR) of the University of Amsterdam. Dr Sophie C Internet Policy, Washington (October 2016), and the anonymous Boerman is assistant professor of Persuasive Communication at peer reviewers for their valuable comments on drafts for this the Amsterdam School of Communication Research (ASCoR) of paper. the University of Amsterdam. Prof Dr Natatali Helberger is 1 We use the phrase ‘data privacy law’ if we refer to both the rules professor Information Law at the Institute for Information Law in the ePrivacy Directive and in data protection law. (IViR) of the University of Amsterdam. For correspondence: <f.j [email protected]> 2 Proposal for a Regulation of the European Parliament and of the All authors cooperate in the Personalised Communication Council, concerning the respect for private life and the protection Project <http://personalised-communication.net>. The research of personal data in electronic communications and repealing for this article was made possible with the help of research Directive 2002/58/EC (Regulation on Privacy and Electronic funding from the University of Amsterdam (Personalised Commu- Communications) COM(2017) 10 final, <https://ec.europa.eu/ nication - PI’s Prof Dr Claes de Vreese and Prof Dr Natali Hel- digital-single-market/en/news/proposal-regulation-privacy-and berger), and a research grant from the European Research Coun- -electronic-communications> accessed 7 September 2017. 2 Tracking Walls, Take-It-Or-Leave-It Choices EDPL 3|2017 walls; (ii) ban tracking walls in certain circum- had to advertise in certain media to reach certain peo- stances; (iii) fully ban tracking walls; (iv) ban all web- ple. The price of an ad is based, among other things, wide tracking (third party tracking). We argue that on the number of readers.10 By way of illustration, a the lawmaker should seriously consider options (ii) printed newspaper with many wine lovers among its and (iii): a partial or complete ban of tracking walls.3 readers could be a good place for a wine merchant to advertise. And the book review pages of a printed newspaper could be a good place to advertise a book. II. Online Tracking The newspaper assembles an audience, and provides the advertiser access to this audience. Contextual ad- People can use many online services, such as web- vertising is a type of online advertising that resem- sites, email services, and search engines, without pay- bles print advertising, as ads are placed in the con- ing money. Large amounts of data about users are text of related content. With contextual online adver- usually collected through such services. Those data tising, advertisers aim to reach people by showing are typically used for behavioural targeting, a mar- ads on certain websites or pages – for example ads keting technique which involves monitoring people’s for wine on websites about wine. online behaviour, and using the collected informa- By contrast, with behavioural targeting, an ad net- tion to show people individually targeted advertis- work can show a wine ad anywhere on the web to ing.4 people whose profile suggests that they like wine. An In a simplified example, behavioural targeting ad network does not have to buy expensive ad space works as follows. Advertising networks are compa- on a large professional website, such as a newspaper nies that serve advertising on websites. Such ad net- works track people’s browsing behaviour over mul- tiple websites, using cookies or similar technologies. 3 The paper builds on, and includes sentences from: Frederik J (We speak of ‘cookies’ for readability, but ad networks Zuiderveen Borgesius, Improving privacy Protection in the Area of use many other tracking technologies too, such as Behavioural Targeting (Kluwer law International 2015) and Fred- erik J Zuiderveen Borgesius et al, ‘An Assessment of the Commis- 5 flash cookies and device fingerprinting. ) By follow- sion’s Proposal on Privacy and Electronic Communications’ (Directorate-General for Internal Policies, Policy Department C: ing people’s browsing behaviour, ad networks build Citizen’s Rights and Constitutional Affairs, May 2017) <https://ssrn a profile of people’s inferred interests, to show them .com/abstract=2982290> accessed 7 September 2017. more targeted ads. For instance, an ad network may 4 Sophie Boerman, Sanne Kruikemeier and Frederik J Zuiderveen Borgesius, ‘Online behavioral advertising: a literature review and show wine advertising to people who visited web- research agenda’ (2017) 3 Journal of Advertising 363-376. sites about wine. Many websites allow dozens of ad 5 Chris Jay Hoofnagle et al, ‘Behavioral advertising: the offer you networks and other third parties to store tracking cannot refuse’ (2012) 6 Harvard Law & Policy Review 273. cookies on their visitors’ computers.6 Tracking peo- 6 Ibrahim Altaweel, Nathaniel Good and Chris Jay Hoofnagle, ‘Web Privacy Census’ (Technology Science, 15 December 2015) ple across multiple websites (for instance by ad net- <http://techscience.org/a/2015121502> accessed 7 September works) is called ‘web-wide tracking’ or ‘third party 2017. 7 World Wide Web Consortium, ‘Tracking Preference Expression tracking’. Tracking within one website could be called (DNT), W3C Candidate Recommendation 20 August 2015’ ‘site-wide tracking’.7 (2015) <https://www.w3.org/TR/tracking-dnt> accessed 7 Septem- ber 2017; Article 29 Working Party, ‘Opinion 01/2017 on the Websites are often funded by advertising. Some- Proposed Regulation for the ePrivacy Regulation (2002/58/EC)’ (4 times, advertisers only pay a website publisher if April 2017) 18. somebody clicks on an ad. Few people click on ads. 8 Dave Chaffey, ‘US, Europe and Worldwide display ad click- through rates statistics summary’ (Smartinsights, 8 March 2017) Roughly, if an ad is shown 10,000 times, less than five <http://www.smartinsights.com/internet-advertising/internet -advertising-analytics/display-advertising-clickthrough-rates/> ac- people click on that ad (a ‘click through rate’ of cessed 7 September 2017: ‘Across all ad formats and placements 0.05%).8 Behavioural targeting was developed to Ad CTR is just 0.05%. So, this is just than 5 clicks per 10000 make more people click on ads. Some claim that be- impressions (...)’ 9 See, Howard Beales, ‘The value of behavioral targeting’ (Network havioural targeting is more effective than non-target- Advertising Initiative, 2010) <https://www.networkadvertising.org/ ed ads, and that it leads to more income for website pdfs/Beales_NAI_Study.pdf> accessed 31 August 2017. See 9 also, Katherine J Strandburg, ‘Free Fall: The Online Market’s publishers. Consumer Preference Disconnect’ (University of Chicago Legal However, in the long term, behavioural targeting Forum, 2013) 95 <http://bit.ly/2kkIh9T> accessed 28 September 2017. may lead to less income for certain website publish- 10 Fernando Bermejo, The internet audience: Constitution & mea- ers.